University Hospitals Employee Disclosed Patient Info

CLEVELAND — A University Hospitals Rainbow Babies & Children’s Hospital employee disclosed patient information in an email, the hospital system said.

The incident happened earlier this year when the employee sent a group email about changes in the University Hospitals billing system. The email was sent to a group of patients and their email address were all visible in the "to" field.

The email did not explicitly define any individual's diagnosis, but it did imply that everyone who had received the message had the same condition. Everyone on the email will receive a letter from University Hospitals.

The email went out on Feb. 28, according to University Hospitals. The hospital system launched an investigation into the incident that same day.

"The employee’s unauthorized disclosure of patient information violated UH policies and procedures. UH is not aware of any identity theft or harm to patients caused by the employee’s unauthorized disclosure of patient information, but UH is notifying appropriate individuals of this incident out of an abundance of caution," the hospital system said in a statement provided to Patch.

In response to the situation, University Hospitals said it has:

• Educated the employee that sent the email on proper procedure for communicating with patients electronically.
• Notified appropriate regulatory bodies.
• Notified all individuals whose information was part of the incident.
• Provided education regarding patient privacy and HIPAA.

The hospital system said it also provided education and training to all of its staff on how to properly utilize digital communication tools when speaking with patients.